HP Brocade BladeSystem 4/12 HP StorageWorks Fabric OS 6.x administrator guide - Page 106
Creating a DCC policy, Saving changes to ACL policies
View all HP Brocade BladeSystem 4/12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 106 highlights
• You cannot manage proxy devices with DCC policies. Proxy devices are always granted full access, even if the DCC policy has an entry that restricts or limits access of a proxy device. Creating a DCC policy DCC policies must follow the naming convention "DCC_POLICY_nnn," where nnn represents a unique string. The maximum length is 30 characters, including the prefix DCC_POLICY_. To save memory and improve performance, one DCC policy per switch or group of switches is recommended. Device ports must be specified by port WWN. Switch ports can be identified by the switch WWN, Domain ID, or switch name followed by the port or area number. To specify an allowed connection, enter the device port WWN, a semicolon, and the switch port identification. The following methods of specifying an allowed connection are possible: • deviceportWWN;switchWWN (port or area number) • deviceportWWN;domainID (port or area number) • deviceportWWN;switchname (port or area number) To create a DCC policy: 1. Connect to the switch and log in using an account assigned to the admin role. 2. Type secPolicyCreate "DCC_POLICY_nnn", "member;...;member". DCC_POLICY_nnn is the name of the DCC policy; nnn is a string consisting of up to 19 alphanumeric or underscore characters to differentiate it from any other DCC policies. The member contains device or switch port information: deviceportWWN;switch(port) where: deviceportWWN switch The WWN of the device port. The switch WWN, Domain ID, or switch name. The port can be specified by port or area number. Designating ports automatically includes the devices currently attached to those ports. The ports can be specified using any of the following syntax methods: (*) Selects all ports on the switch. (1-6) Selects ports 1 through 6. [*] Selects all ports and all devices attached to those ports. [3, 9] Selects ports 3 and 9 and all devices attached to those ports. [1-3, 9] Selects ports 1, 2, 3, 9, and all devices attached to those ports. "*" This can be used to indicate DCC lockdown. This will create a unique policy for each port in the fabric, locking it down to the device connected or creating an empty policy to disallow any device to be connected to it. This can be done only when there are no other DCC policies defined on the switch. 3. To save or activate the new policy, enter either the secPolicySave or the secPolicyActivate command. If neither of these commands is entered, the changes are lost when the session is logged out. For more information about these commands, see "Saving changes to ACL policies" on page 108 and "Activating changes to ACL policies" on page 108. 106 Configuring advanced security features